GitHub Security Lab Shipped gh-secure So You Can Stop Shipping Open Source Naked
gh extension install GitHubSecurityLab/gh-secure. Dry-run, then enable the boring defaults. Green toggles are not a force field, but naked repos are worse.
Read Full News
That ClickFix Paste Just Installed Variola, Not a “Fix”
ClickFix to Windows Terminal to GitHub sha payload to Variola core. Hunt 4A-D3, uid.dat, smallpox section, mutexes. Stop pasting ‘fixes’ from webpages.
Fortinet CLI Path Traversal Hit CISA KEV 185 Days After Fortinet Already Patched It
April advisory, October KEV. CVSS 6.0 authenticated CLI write/delete. Upgrade 7.6.5/7.4.10 trains, migrate dead ones, due Oct 19.
Hunt SAWFLY and BARECLAW on BeyondTrust After CVE-2026-102764
Public Mandiant IOCs turned into lab greps: mangoapi.php, _c94mfe, ingredi_ws, /uidchanarge, zz-root-persist. Patch first. Hunt off-box logs. Rebuild if trust is gone.
BeyondTrust Remote Support Just Got Rooted by the People It Was Meant to Keep Out
Unauthenticated file ops on Remote Support, Mandiant zero-day abuse since late August, KEV Oct 16 due Oct 19. Patch BT26-05-RS, hunt SAWFLY/BARECLAW, rotate vaulted creds.
Data Centers Are War Targets Now and Dual-Use Is the Whole Punchline
Commercial racks hosting military gravity put civilian apps in the outage radius. Separate stacks, diversify regions, update the BCP slide.
GitHub Made AI Scan for Pull Requests Generally Available and It Still Will Not Fail Your Check
AI findings for PHP, Terraform, Dockerfiles and more. Advisory only. Cannot fail checks or block merges. Useful signal, not a force field.
The FBI Says Midterm Season Is Open Season on Your Wallet and Your Voter File
Fake PACs, fake merch, fake voter links, AI voice clones. vote.gov for registration, FEC for committee checks, IC3 for reports.
Your MSP Backup Console Got Webshells, Fake Edge XMRig, and a CISA KEV Stamp
Exploitation since October 7, hotfixes that actually close the door, KEV on October 14. Hunt MicrosoftEdgeUpdateSvc and rebuild dirty boxes.
Atlassian Just Handed Strangers Your WEB-INF and CISA Put It on the Calendar
Unauthenticated file read across eight Atlassian Data Center products. KEV on October 15, due October 18. Patch, mitigate, rotate Crowd secrets.